There is increasing economic incentive for companies to secure their own supply chains and to increase control of their distribution chains. Various processes are known for verifying movement of an item between different entities in a supply chain across a supply network. Verification may be desired for a variety of reasons. For example, there are commercial and safety requirements for a supply chain of branded goods, in particular pharmaceutical products, to be verified to avoid counterfeit products being introduced into an authorised supply chain.
Radio-Frequency IDentification (RFID) tags are well known. RFID tags are circuits in the form of label-like items that can be read (and sometimes also written on) by reader (and writer) units communicating with the tags at “RF” frequencies. RFID tags can generally be incorporated into or attached to products, packaging, animals or other items for example for the purpose of identification using radio waves. A particular application relates to tracking of items. RFID tags generally contain two parts: an integrated circuit for storing and processing information and an antenna for transmitting (and receiving) information to (and from) an RFID reader (and writer) device up to several meters away. RFID is mainly used today within enterprises' supply chain management applications to improve inventory visibility and prevent issues such product counterfeiting. Further details relating to the general field of RFID tag technology can found in, for example, Landt, Jerry (2001), “Shrouds of Time: The history of RFID”, AIM, Inc.
Major pharmaceutical companies are actively involved in evaluating RFID as part of their anti-counterfeiting strategies, in addition to using other current covert authentication technologies and labour intensive inspections and investigations. For example, pharmaceutical companies want their distribution chains secure both in terms of product authentication and product pedigree.
Generally, the basic approach involves attaching an RFID tag to a product and giving a unique identifier to each item. Approaches that have previously been proposed integrate a product check with a pedigree record. A “product pedigree” is the historical record of a product lifecycle. It contains information about the product in the supply chain from the point of manufacture through one or more distributors until the product reaches its final customer. A product pedigree can also provide item level tracking, instead of batch level tracking—each item has a unique serial level identifier that uniquely identifies a product and its manufacture.
The following possibilities exist for implementing such product pedigree solutions:
1. Incorporating a unique identifier into the product. The unique identifier may be a 2-d barcode (data-metric barcode) or an RFID tag (e.g. EPC C1 Gen2), for example.
2. Tracking the product across the full supply chain, from the point of manufacturing through the distribution chain until the point of sale of the product.
3. Maintaining a database or a centralised server containing information about the pedigree of the product.
Although such an “e-pedigree” solution provides advantages in countering counterfeiting and diversion activities, there are still problems to resolve before a truly secure solution can be obtained:
1. Secure Tags: Current solutions do not use cryptographic mechanisms in the tags. Without a mechanism to protect a tag it may be hard to identify if a tag is original or just a “clone” (i.e. a copy of a tag arranged to give the same responses to challenges as the original). Cloning is a problem particularly if products take a long period to reach the market, allowing for the possibility of goods carrying cloned tags arriving on the market before the legitimate goods.
2. Integrity of Product Pedigree Records: Product pedigree may be largely incomplete. If a pedigree record misses important product information then it may be hard to decide whether the product is authentic or counterfeit. Collecting full pedigree and supply chain visibility information is a significant problem as companies are often unwilling to invest for little self-gain, and often have reservations about sharing their confidential business information.